|
Treat Policy Engine denials and UnauthorizedAccessException results as terminal tool failures by adding RetryAllowed metadata to ToolExecutionResult.
Stop the Agent loop immediately after recording the denied tool result, transition the Task to failed, and run normal Task resource cleanup instead of returning the same failure to the LLM for another iteration. Correctable validation and process failures retain the existing bounded retry behavior.
Expose RetryAllowed in llm.jsonl and document the fail-fast security invariant in Specifications, Design, and ImplementationPlan.
Tests: Agent.Core.Tests 50/50 passed with skip 0; Release build passed with 0 warnings and 0 errors. The full Windows suite remained environment-blocked outside an elevated token: 14 tests failed while creating/deriving the fixed AppContainer or creating symlinks; 11 passed and none were skipped.
Release: refreshed the win-x64 self-contained folder binaries, publish manifest, ZIP, and checksum while preserving the local agent.yaml. The clean ZIP contains no runtime logs or Task state.
|
|
Add a concise Japanese companion prompt that asks the model to be approachable, clarify uncertainty, select available skills and tools, verify results, and report the next useful action without adding excessive context.
Add the standard skills/python-via-uv/SKILL.md package and UI metadata. The workflow uses uv python find offline to resolve an interpreter, then asks the Broker to launch the separately approved Python executable. It deliberately avoids uv run because the v1 OS child-process restriction must reject descendants created directly by uv.
Support standard skills/<name>/SKILL.md directories while retaining legacy top-level Markdown loading. Skip reparse-point skill directories, load deterministically, package the complete skills tree, and avoid loading nested reference Markdown as independent skills.
Validation: skill-creator quick_validate PASS; uv 0.11.23 resolved Python and the two-stage Python execution printed UV_BROKER_TWO_STAGE_OK. Release build passed with 0 warnings/errors; Core tests passed 49/49 with skip 0. The 1.0.0 Bundle and manifest were regenerated with the prompt and Skill.
|
|
HTTP observability callbacks previously called RollingFileLog synchronously. RollingFileLog writes to Console.Error before the application file, so a paused console or an undrained redirected stderr pipe could block Kestrel request threads for minutes and cause otherwise valid MCP clients to time out.
Route ready, connection, request-started, request-completed, and HTTP JSONL work through a bounded 4,096-entry Channel. Request callbacks use TryWrite and never wait for console or file I/O. A dedicated single-reader background task preserves log ordering, performs rotation, reports dropped entries after queue pressure, and contains non-fatal sink failures.
Keep the queue bounded so a stalled console cannot cause unbounded memory growth. When capacity is exhausted, request availability takes precedence over observability and the dropped count is emitted as an application warning after the writer resumes.
Add a regression test with a deliberately blocked console writer. The background writer remains blocked while the HTTP completion callback returns within 250 ms. Release build passed with zero warnings and errors; Core tests passed 48/48 with skip 0.
Regenerate the win-x64 self-contained 1.0.0 Bundle and ZIP. ZIP SHA-256: 62E28C903880A51614EC0C3CE23409580F803C7C124764CA7E1CB0EB2CCAA7A9.
|
|
Replace the MCP 1.4.1 stateful HTTP design with the official C# SDK 2.0.0 stateless transport. The SDK now owns protocol negotiation, server/discover, standard MCP headers, GET and DELETE handling, error serialization, caching hints, and legacy initialize compatibility; production code no longer maintains a custom wire-protocol workaround for MCP Inspector.
Separate transport state from application conversation state. HTTP does not issue Mcp-Session-Id, while the existing session_id remains an Agent conversation identifier. Preserve agent_run and agent_status for clients without Tasks support and add the official ModelContextProtocol.Extensions.Tasks 2.0.0 path for capable clients.
Add persistent MCP Task storage with atomic JSON replacement, user-only state location, configurable TTL and poll interval, restart recovery, cancellation correlation, and public Agent-to-MCP state mapping. Keep conformance-only tools and protocol exception fixtures in a test host so they cannot enter the Release Bundle.
Run administrator, BFE, WFP transaction, and filter add/delete preflight before binding. Fail fast with exit code 2 and actionable localized diagnostics when sandbox enforcement is unavailable. Emit ready only after the listener starts and keep stdio stdout protocol-pure.
Add shared rotating application and HTTP request logs. Record real socket endpoints, connection and trace identifiers, method, path, result, timing, media metadata, User-Agent, and MCP metadata. Do not trust X-Forwarded-For and do not log authorization, cookies, query data, request or response bodies, prompts, images, or Base64 payloads.
Add typed logging and Tasks configuration, Japanese and English messages, protocol and operations documentation, design/specification deltas, traceability, and exact conformance acquisition/offline runner scripts for @modelcontextprotocol/conformance 0.2.0-alpha.11. Node remains test-only and is not a runtime dependency.
Conformance evidence: server-stateless passed 28 of 28 checks with zero unexpected failures; DNS rebinding and multiple POST stream scenarios passed. The alpha Tasks lifecycle/cancel/error/required-task checks passed, while its wire-schema validator misclassifies CreateTaskResult and its MRTR composition remains incompatible with SDK 2.0.0. The aggregate conformance Gate is therefore recorded as PARTIAL, not PASS. Test-host fixture gaps for tools-list descriptions, JSON Schema diagnostics, caching fixtures, and a header-validation/required-Task capability conflict are also recorded without expected-failure masking.
Verification: Release build passed with 0 warnings and 0 errors; Planner tests 10/10 and Core tests 47/47 passed with skip 0. The last Windows suite run passed 19/25; five WFP cases require an elevated token and one symlink case requires unavailable host privilege, so the elevated security Gate remains open. A win-x64 self-contained 1.0.0 Bundle and ZIP were regenerated under build/Release/publish; runtime check was intentionally skipped in this non-elevated session. Evidence remains under ignored artifacts/evidence/mcp-2026-07-28.
Harden release regeneration when another shell holds the previous Bundle directory as its current directory: validate the target and remove only its children instead of deleting the directory itself. build/ and artifacts/ remain excluded from Git.
|
